property-based testing for C